topic Re: Splunk Enterprise security Incident Review table not showing. in Splunk Enterprise Security

Splunk Enterprise security Incident Review table not showing.

jadengoho — Sun, 07 Jun 2020 16:05:24 GMT

Hi All,
Would like to know what causes this issue , please see screenshot attached.
There's an event "42" showing and time range is showing , but the table is not showing.
SplunkEnterpriseSecuritySuite = version :5.3.0

Re: Splunk Enterprise security Incident Review table not showing.

DavidHourani — Tue, 28 Apr 2020 05:22:14 GMT

Hi @jadengoho,

Did you try clearing your browser cache or connect using another browser ? Seems like broken or cached CSS

Cheers,
David

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Wed, 29 Apr 2020 01:35:06 GMT

Hi @DavidHourani - i tried restarting my laptop and reconnecting to the internet.Will try clearing browser cache when it happend again.

Re: Splunk Enterprise security Incident Review table not showing.

DavidHourani — Wed, 29 Apr 2020 05:06:51 GMT

@jadengoho, that's great to hear ! Please accept the answer if your problem is solved 🙂

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Thu, 30 Apr 2020 05:10:24 GMT

@DavidHourani - i tried clearing cache, changing browser and restarting my device but still issue occur.

Re: Splunk Enterprise security Incident Review table not showing.

DavidHourani — Thu, 30 Apr 2020 07:22:27 GMT

Ummm.. could you please check what you get if you run index=notable from the search interface ? That will help you make sure that those notables are actually populated and not empty events.
If index=notable is working then try this to ensure that events from incident review are there : |incident_review
Also play around with the time picker to see if you can see older events on both searches and on the incident review page.

Re: Splunk Enterprise security Incident Review table not showing.

MuS — Thu, 30 Apr 2020 07:42:09 GMT

There are 42 matching events ... I reckon this ES has found the answer to everything 😉

cheers, MuS

Re: Splunk Enterprise security Incident Review table not showing.

DavidHourani — Thu, 30 Apr 2020 07:45:15 GMT

I guess we're going to have to wait another 7½ million years for the results to display ...

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Thu, 30 Apr 2020 08:00:25 GMT

@DavidHourani - search is returning results, and when i change the time picker = time range shows the event count per day - but the table is not showing anything.
Also the pagination is showing. tried to change page still not showing.

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Thu, 30 Apr 2020 08:21:34 GMT

@MuS - what could be the reason behind this ?

Re: Splunk Enterprise security Incident Review table not showing.

DavidHourani — Thu, 30 Apr 2020 08:39:45 GMT

@jadengoho, have you done any upgrades for ES recently ? Or have you changed any permissions for your user recently ?
There is a known issue for ES 5.3.0 where mis-configured roles might lead to the incident review page not loading :
https://docs.splunk.com/Documentation/ES/5.3.0/RN/KnownIssues
Issue : SOLNESS-21783

Re: Splunk Enterprise security Incident Review table not showing.

MuS — Thu, 30 Apr 2020 08:51:41 GMT

This ^^^ or permission issues or ... anything else that could cause an error in ES.

Did you check all the internal logs of Splunk to see if you get errors when opening the 'Incident Review'?
Any other error in any other log files?
As @DavidHourani has asked, did you recently upgraded and did you restart Splunk after that?
Have to tried to _bump the Splunk instance?
I could add so many things to this list, but without more details we will never be able to help.

cheers, MuS

PS: It looks like you did not get my previous joke about 42 😉

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Thu, 30 Apr 2020 08:52:06 GMT

@DavidHourani - i do have splunk admin access but issue still occur.
sometime the table shows but most of the time it's not showing.

Re: Splunk Enterprise security Incident Review table not showing.

DavidHourani — Thu, 30 Apr 2020 09:17:04 GMT

@jadengoho, that's weird ... this "sometime the table shows but most of the time it's not showing" is most of the times due to cache... What browser are you using ? And could you try to change it ?

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Thu, 30 Apr 2020 09:24:12 GMT

@MuS
Did you check all the internal logs of Splunk to see if you get errors when opening the 'Incident Review'? Yes i investigated it , think all Error and Warn are really not related to the issue like

truncating lines because of limits.
Socket Errors from.
Asynchronous bundle replication to
An error occurred during the last operation ('deleteData'
Error checking for update, URL=https://apps.splunk.com
Received fatal SSL* alert. ssl_state='SSLv*
Racing between mark job dispatched and heartbeats
No response received from IMonitoredThread
Missing a search command before
The instance is approaching the maximum number of historical searches
We recommed using RSA-SHA* for 'inboundSignatureAlgorithm'

did you recently upgraded and did you restart Splunk after that? im not the one who upgrade it 1yr ago, but i saw in the process that it has a restart.

Have to tried to _bump the Splunk instance? Not yet , will this once the issue occur again

It looks like you did not get my previous joke about 42 😉 - HAHAHA still didn't get it.

Re: Splunk Enterprise security Incident Review table not showing.

MuS — Thu, 30 Apr 2020 09:28:01 GMT

In regards of 42 ... https://www.independent.co.uk/life-style/history/42-the-answer-to-life-the-universe-and-everything-2205734.html

And you have some search errors there; on ES that could indicate a problem - just saying ...

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Thu, 30 Apr 2020 09:35:57 GMT

@DavidHourani - we are using Internet Explorer version 11.09. We can't use other browser [IT setup that way].

@MuS hahahha now i get it 42 is the real deal
i do audits on ES but nothing really .

Re: Splunk Enterprise security Incident Review table not showing.

DavidHourani — Thu, 30 Apr 2020 10:03:19 GMT

@jadengoho, then in that case next time you face the issue please try hitting the _bump or refresh endpoint:
mysplunkhost:8000/en-US/debug/refresh or mysplunkhost:8000/en-US/_bump

And make sure you didn't set up splunk on deep thought. This could be why you're getting 42. @MuS can confirm.

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Thu, 30 Apr 2020 10:27:21 GMT

@DavidHourani - sure will notify you once issue occurred again. Also, thanks for the notif whahaha. 🙂

Re: Splunk Enterprise security Incident Review table not showing.

jadengoho — Thu, 14 May 2020 06:55:41 GMT

Hi All, Issue still exist- and we are looking at the internet connection using vpn might be the issue